On the Risk of Structural failure on Norwegian Offshore Installations
Av Arne Kvitrud, Gerhard Ersdal and Roger L Leonhardsen
The purpose of this paper is to review the worldwide historical structural failure data in the 1990s on offshore structures, and compare this with the present risk analyses of Norwegian offshore structures.
The paper describes an overview of registered accidents to offshore structures based on the databases WOAD and CODAM. The accident data is given for fixed platforms, jack-ups and for floating platforms. Estimates of risk level in annual frequencies and PLL values are given for each platform type.
The paper concludes that:
· The risk connected to marine operations and structures give a significant contribution to the total risk.
· The historical risk to marine operations and structures is significant higher than the results from risk analyses.
· Neither component nor system based reliability analyses of structures give adequate descriptions of the real risk connected to structures.
· Human errors are probably the dominating cause of accidents connected to structural failure.
This work was initiated as a part of the project to evaluate the development of the safety on the Norwegian Continental shelf. We have counted the number of incidents related to 24 different indicators during the period 1996-2000. A safety index for the Norwegian Continental shelf is calculated. To get one index the different types of incidents (as fire, kicks, collisions and major cracks in structures) have to be given a weight based on its relative importance to the fatality risk. Vinnem et al (2001) give more details and conclusions of the project.
In Norwegian risk analyses structural failure turn up with an insignificant contribution to the risk in the industry. The risk analyses are normally giving results in accordance with reliability analyses, dealing only with intrinsic and inherent uncertainty. In general, these reliability analyses give risk contributions from structures which is at least an order of magnitude lower than what is found from blow-out and process risk assessments. On the contrary, structural failures in UK risk analyses (DNV Technica, 1995 and Sprouge, 1999, page 155) give a significant contribution to the total risk.
Reliability analyses are generally used for risk analyses, risk based inspection programs, code calibration, risk based design and reassessment of structures. In this paper only the use connected to risk analyses will be discussed.
In this paper we will present a historical risk to structural failure in general, based on worldwide statistics. The contributions to the historical risk statistics are dependent of the type of structure, and due to this we will continue by reviewing each type of structure. The next step will be to look into what results reliability analyses is giving, and compare these with the historical data. Based on this we will argue that the use of reliability analyses results in a risk analyses is questionable.
Incidents and accidents on platforms on the Norwegian continental shelf are to be reported to Norwegian Petroleum Directorate (NPD). NPD compile the information for use in statistics and analysing trends. For this purpose the CODAM database is applied. The database contains information such as incidents, inspection findings and specific installation data. Data has been recorded from the mid 1970s. Initially the database was designed for jacket structures and pipelines, but later adjustments have made it suitable for all types of installations. CODAM is an in-house database for and maintained by NPD, but the recorded information is available for public use upon request. Incidents and inspection findings are classified into one of three severity levels: Insignificant, Minor or Major.
CODAM is an in-house database for and maintained by NPD, but the recorded information is available for public use upon request. The most recent publication on the incidents reported in CODAM related to structures is given in Hamre et al (1991) and Leonhardsen et al (2001).
The world offshore accidental database (WOAD) is used to give a worldwide reference (DNV Technica, 1995). The data in the base are classified as insignificant, minor, major, severe and total loss. In this review, only data classified as severe or giving total loss of the installation, are used. This classification is used for severe damage to one or more modules of the unit; large to medium damage to load carrying structures, major damage to essential equipment (as BOP, wellhead, riser or X-mas tree), toppling or sinking of fixed units, capsizing or sinking of mobile units and collapse of drill derricks. We have used the data restricted to the period 1990-1999. Funnemark (1997) gives the most updated review of the WOAD data.
Ten accidents are reported from Norway as "severe" and ”total loss”. We have an average in the 1990s of about 110 platforms. On a world basis there is about 8.000 installations with 174 serious incidents. Based on a direct comparison scaling between the Norwegian data and the worldwide data, a rough assumption may be that less than one third of the worldwide serious incidents are reported. The data coverage in WOAD for different causes is not randomly distributed. Sprouge (1999) discusses the representativity of WOAD. From our interpretation the database gives a relative overrepresentation of incidents related to structures, collisions and blow out incidents. For process, riser and pipeline related incidents the WOAD data are more limited, and mainly restricted to published data.
It can be argued that some types of platforms are not relevant, or that something irrelevant for Norway was included in a marine operation. Similar arguments may be used also for blowouts and process accidents. To get an understanding of the frequencies and to describe the relative contributions the number of cases declared irrelevant should be handled similarly in all disciplines. New techniques, materials and barriers have also made some of the older incidents irrelevant. It has been important for us to evaluate the structural events for its relevancy to Norway. The other events have been kept unchanged. This is believed to a conservative approach for our purpose. Major incidents related to structural failure in Norway has been the loss of Frigg DP1 jacket during installation 12.10.1974, the capsize of the flotel Alexander Kielland 27.3.1980 causing the death of 123 men, the capsize of the jackup West Gamma 21.8.1989 and the loss of the concrete gravity structure Sleipner A-1 23.8.1991. Based on the large number of incidents we cannot claim the structural safety level in Norway is significantly different from the worldwide average.
The causes of all incidents reported in WOAD for the period 1990-99 are shown in figure 1.
The hurricane Andrew is an important event in the 1990s (for details see Wish, 1992, Daniels, 1993 and Kareem, 1999). The hurricane occurred in1992 in the Gulf of Mexico. The return period for the waves were somewhere between 25 and 100 years (Kareem et al, 1999). It is appropriate to ask whether the large number of incidents in this hurricane relevant for Norway?
The API RP-2A got a major update in the end of the 1960s. The requirements to structures were significantly increased (Sprouge, 1999). A similar level of safety has been required from about 1970 up until present. Platforms built before 1970 might be regarded as not relevant for Norway as all platforms on the Norwegian continental shelf are made after 1970, and not according to API requirements from the1960s. 23 platforms built after 1970 were significantly damaged (Sprouge, 1999, page XI.6), and these will be denoted as “relevant” cases in the following. Different numbers for how many platforms built after 1970, occur in the literature. Also the number of damaged platforms in the hurricane varies. We have selected to use the data from Sprouge (1999). It should also be mentioned that the safety factors in API for ultimate limit state controls are slightly higher than required in Norway, but this may not lead to an increased safety level on “API” jackets as the variability of the weather is larger in this area. Norwegian platforms designed after 1984 (36 of 67 jackets) also have to be checked against an environmental load with annual probability of 1*10-4. Prior to this, 31 jackets were designed with similar deck clearance as in the Gulf of Mexico. The hurricane Andrew was the largest hurricane in the Gulf of Mexico during the period 1970-2000, but also other hurricanes have caused damage in this period (Sprouge, 1999).
Figure 1: The causes of all reported severe or total loss incidents in WOAD for the period 1990-99. No reduction in any causes has been made.
In order to give a conclusion to the question asked: To select the relevant cases for risk assessment in Norway will be subjective, but we have tried to do it. Some of the structural types might also not be relevant for Norway. Many of the incidents in the Gulf of Mexico might have caused fatalities in Norway, as people are evacuated from the platforms in the Gulf of Mexico during extreme weather, while we normally do not evacuate.
The probability of a significant incident caused by a structural failure on location, during transportation and installation has for the period 1990-99 been in the order of magnitude 11*10-4 pr platform year. So far, the data have been presented independent of structure type. In the following sections, these data will be divided according to structure type (fixed steel and concrete, jack-up and floating platforms).
Most of the fixed steel structures damaged in the hurricane “Andrew”, are classified as wellhead structures or satellites. Some of them might be relevant for Norwegian unmanned platforms, but we do not have sufficient information to evaluate them in this regard. Twelve platforms are categorized as jackets in WOAD and suffered "severe damage". Just one jacket was installed later than 1970. The deck of the platform was severely damaged, but the jacket was not. A substantial contributor was that the deck was never fully welded to the jacket at the connections and the deck was basically pushed off the top of the jacket. We have not had the possibility to study all the events in detail. Even if only one event would be strictly relevant, we have as a rough estimate for the statistical treatment, assumed two of the hurricane “Andrew” events to be relevant.
The accidents connected to installation of fixed steel structures are the tilting of a jacket, possibly due to a mudslide, a toppled jacket during installation, due to problems with the mud mats, one having pile foundation error, one with tilting of the drill tower and one lost a module during lifting. Only the drill tower accident caused loss of lives.
Sharples et al (1989, page 114) have for the 1980s structural “mishaps” of fixed steel structures as about 5% of the total number of “mishaps”, but they also have a significant “other” group. A direct comparison is not easy. Bekkevold et al (1989) have from the 1980s, structural damage as the cause in 4% of the total losses to fixed platforms, and 7% in the 1970s. They also have a significant number of “other incidents”. The frequency from the 1990s is similar to the previous periods. As discussed above for the WOAD data coverage, these numbers are probably an upper bound on the relative importance of structural failure.
The total number of jacket type structures is unknown to us. Most likely the structural failure probability of 7*10-4 pr platform year for any fixed steel platform will be on the conservative side for the jacket structures. Disregarding most of the hurricane Andrew events the conclusion must be that the in place risk for fixed structures is rather low. The installation phases though give significant contribution to incidents.
For fixed concrete platforms there are two incidents in WOAD, one fire on the topsides and the sinking of Sleipner A-1. The number of events and platform-years is to low to be used to give a reasonable risk estimate based on historical data
Figure 2: Relative distribution of “relevant” cases of incidents in WOAD for fixed steel structures in 1990-99. The total number of relevant cases is 29.
Sharples et al (1989) have reported “mishaps” on jackups for the period 1979-88. A comparison of causes with the 1990s, gives similar results of the relative severity as demonstrated in figure 3. Incidents connected to marine operations and structures are in both periods dominating the incidents statistics. About half of the risk is connected to the installation and transportation.
Figure 3: The causes on jackup platforms of “mishaps” in Sharples et al (1989) for the period 1979-88 and “severe/ total loss” in WOAD in the period 1990-99. Sharples et al (1989) had 227 cases. The WOAD data contains 27 cases.
For the Norwegian continental shelf the worldwide data have to be evaluated for relevancy. The use of jackups in Norway is limited because our water depths are from 65m and upwards. We have had a few cases of soil related problems in Norway in the category less than severe. Punch-through is when the jackup is standing on a stiff soil (frequently sand), and because of loads or scour the leg is penetrating through the layer and into a softer soil (frequently clay). Two similar incidents have been reported in Norway. In January 1995 one of the legs of West Omicron sank 1.5m. In 1990 Kolskaya experienced scour around one of its legs. If the storm had lasted longer or had higher waves, punch-through could have been the result. Fine graded sand was on top of soft clay. The worldwide jackup soil incidents are assumed to be relevant.
A structural accident probability of 35*10-4 pr platform year for jack-ups is experienced. Incidents related to structures are the dominating cause of failure on jack-ups. The failure probability is significantly higher than for other fixed structures.
The number of events on floating platforms is lower than for the other types of structures, but the number of platforms is also lower. The following incidents may be mentioned:
Barges for drilling and work over have had one loss due to sinking and two blowouts.
Drill ships have had one collision and one loss of riser.
One FPU have had a severe riser leakage.
Using all the WOAD data on barges and ships related to the petroleum industry for the 1990s, the frequency of sinking has been 9*10-4 pr platform year, but the number is very uncertain because of the low number of events and platform years. Experience with tankers worldwide (Sprouge, 1999, page XI.27) demonstrates that an annual probability for sinking of tankers above 10.000 dwt during the period 1972-86 is 3*10-4 per tanker. Tveit (1998) has found a total loss of tankers above 50.000 grt worldwide for the period 1970-90 of 8*10-4 caused by failure in structures, ballast and mechanical systems.
The lack of seaworthiness is probably more comparable with “severe” in WOAD, than the number of sinking tankers. A ship undertaking production will have less possibility to leave the location than is the case for ordinary ships, because of its fixed connection to the production risers. An annual probability of 18*10-4 pr tanker that the ship is not seaworthy because of damage to the hull has been found (Sprouge, 1999). The frequencies for grounding, war damages and collisions are not included in the numbers. A production ship being on a fixed location will have a higher risk from wave loading than merchant ships caused by the loading pattern being more or less the same all the time with the ship heading towards the weather (Sprouge, 1999). In addition failures in station keeping, heading control and frequent use of the ballast system also add up to give a higher expected failure frequency of production ships compared with merchant tankers. Up to 1999 the ship shaped platforms in Norway had to comply with a set of safety factors, but higher than traditional tankers. This was changed in 1999 to accept the maritime rules and regulations, and at the same time accepting a higher risk. The risk associated with tankers will be relevant also for future field developments.
For the semis there are only two events in the WOAD database in the 1990s, - one under towing and one with a damaged heave compensator as the initiating events. With only one relevant structural event it is not sufficient to calculate a risk number for semis with any reasonable accuracy. The losses of Aleksander Kielland and Ocean Ranger in the 1980s visualize the inherent risk also for these platforms. Sharples et al (1989, page 108 and 118) demonstrate that the relative number of “mishaps” on semi submersibles was higher than for any other type of structure. The dominating causes of “mishaps” are related to mooring and transit. Bekkevold et al (1989) had the complete opposite conclusion. They concluded that the semi submersibles had a far better safety record than the other types of mobile units. In Norway, semi submersibles are designed with higher safety factors than ships, and also have to comply with Norwegian Maritime Directorate stability regulations, being stricter than the International Maritime Organization requirements.
Component based reliability analyses of structures frequently concludes that structures have an annual probability of failure (typically a crack) of the component in the order of magnitude 1*10-4 (as in Fjell, 1977 and Moan 1995). The method is characterised with a known or assumed bias, coefficient of variation and the statistical distributions of actions and strength. This is the inherent probability if all the technical requirements to the components are met with respect to correct design, crack detection and correct geometry. The most important shortage in these analyses is the analyses of purely individual components and the lack of incorporation of human errors.
System reliability analyses of fixed steel structures give typically an annual probability of failure of the platform in the order of magnitude 1*10-5 for each failure mode (as in Snell, 1996). The analyses are typically performed by non-linear structural analyses taking into account the behaviour of the steel above yield. For a redundant system the component reliability is a lower limit of the system reliability. As for the component reliability analyses these analyses do not model human errors.
In order to estimate the total probability of failure of a structure, a large number of failure modes are relevant, as waves hitting deck, overloading, fatigue, earthquake, corrosion, soil failure, installation, ballasting failure, towing and position keeping system failure. Calculating the probability of failure for a structure based on such a list of failure modes will sometimes be a lower bound solution. There will in most cases be failure modes that are not included, due to underestimation, insufficient knowledge and unknown influences. We have counted the number of reported cracks on jackets in Norway in the period 1976-2000. The experienced annual probability of getting a crack is calculated to be about 35*10-4 for each node and member in the jackets. Cracks in conductor frames are not included. The probability of finding cracks is significantly higher than what would have been the case if the component analyses give a correct picture. If one compare the historical frequency of anchor chain failure with the failure rates found in reliability analyses for semi submersibles a similar large discrepancy is found (Leonhardsen et al, 2001). We expect similar results to be obtained for other types of structures, but without doing this exercise.
The number of platform-years in Norway is limited. As described previously, we have had four incidents with total loss of platforms. The experienced accidents in Norway have a very high frequency (26*10-4 per platform year), but as demonstrated before, - even higher than the worldwide statistics (severe or worse incidents) for the period 1990-99. A system reliability analyses of a fixed steel structure gives typically an annual probability of failure of the platform in the order of magnitude 1*10-5 for each failure mode, - higher for some modes, and lower for others. These numbers are far away from the experienced frequencies of events, both in Norway and worldwide.
A conclusion must be that neither a component nor a system based reliability analyses of structures give an adequate description of the real risk connected to offshore structures. The next question must then be why?
As an attempt to answer this question, we will look into the influence of human errors to structural failures.
In general three types of risk exist (Bea, 1996)
a) The inherent or natural variability.
b) The uncertainties with the calculation methods,
c) Errors performed by individuals, groups or organizations (human errors)
Reliability analyses as performed for offshore structures covers only the first two uncertainties. Are the major discrepancies found between calculated risk and experienced frequencies of severe events caused by human errors?
The experience from our four major structural accidents in Norway, demonstrates that human errors is the most important contributor. Matousek and Schneider (1976) and Schneider (1997, page 14) summarize an investigation of 800 cases with major damage on onshore structures. The risk modelled in our reliability analyses contributed to only 10-25% of the total risk. Human errors contributed with 75-90% of the accidents. It is likely to assume that a large part of the discrepancies between the experienced frequency and the calculated risk can be explained by human errors, also for offshore structures.
To evaluate the probability of human error for a specific project is not a straightforward task. Several authors have presented methods to evaluate the risk in the design phase. The probability of getting a significant error in structural analyses was found to be 20*10-4 (Paté-Cornell, 1990), 30*10-4 (Bea, 1995b) and 90*10-4 (Trbojevic et al, 1996). Bea (1995a) correlates human errors to how familiar the task is, stress, time available, distraction and impairments.
Paté-Cornell (1990) evaluates the effect of an additional quality control. The detection probability varies depending on who are performing the review, and the severity of the error, - from 1% to 80%. Schneider (1997, page 15) found that a thorough discipline check would have found about 32% of the errors and an additional check (as independent verification) would have found about 55% of the errors. Applied on the Norwegian cases additional checks were made for Frigg DP1 and Sleipner A-1, but it still passed through the verification. Discipline checking and verification are useful tools for removing human errors, but they reduce the risk only to a limited extent. Using the calculated failure probabilities and the reduction obtained by quality control activities, a failure rate similar to the experienced failure rates are obtained.
Other aspects of human error are errors in fabrication and installation, and unknown phenomena connected to new types of structures and use of structures outside its previously experienced environment.
In the NPD risk project (Vinnem, 2001) we have based our evaluation of changes in expected fatality rates. Statistics of the numbers of fatalities based on WOAD is very sensitive to a few events and the time period studied. If we had prolonged the database to 1980 the accidents with Piper Alpha, Ocean Ranger and Aleksander Kielland would have been included.
To get an overview of the consequences of major incidents related to structures we have to review the WOAD database information with respect to the number of fatalities and the number of rescued in “severe” and “total loss” accidents. WOAD only describe twelve cases where the number of fatalities and the number of rescued are given. In a few cases it is said that all the people were safely rescued, but without stating how many, indicating that the numbers presented here should be a conservative estimate. In these twelve cases 52 people were lost and 897 rescued, giving a probability of fatality of about 5%. The number of fatalities on the Norwegian Continental shelf caused by our four major structural incidents is 123, giving a fatality frequency of 46%. For the 1990s the number of events and the number of fatalities for structural events seems to have about the same relative importance.
1. Using the worldwide statistics for the period 1990-99 and the experienced frequencies for ”severe” or ”total loss” for structural events, the structural events should not be disregarded in the formal risk analyses.
2. The experienced annual failure probability have been found to be in the order of magnitude 7-35*10-4, and is dependent of the type of structure in question.
3. Neither a component nor a system based reliability analyses of structures give an adequate description of the real risk connected to structures. Human errors are not modelled, and based on the difference on the result from these analyses and the historical data, human errors are probably the dominating cause of accidents connected to structural failure.
4. It is necessary to improve the methodology of how the risk of structures is handled in risk analysis.
This work has been performed as a screening exercise to evaluate the use of present Norwegian risk analysis as a tool to describe the real risk of offshore structure. To get a reasonable weighting between the different causes, we have for our project used the results as described by DNV Technica (1995) – as giving the most realistic representation of the structural contribution.
We have discussed the content of this paper at different stages with several people. Direct input to the paper have come from Mike Prins, Malcolm Sharples, Sverre Haver, Jan Erik Vinnem, Ove Tobias Gudmestad, Ivar Langen, Espen Funnemark, Per Rosengren, Bjørn Ringstrøm and Odd Johannes Tveit. We thank those named and also those not mentioned here!
Bea Robert G: Quality, reliability, human and organization factors in design of marine structures, OMAE volume II, Copenhagen, 1995a.
Bea Robert G: Evaluation of human and organization factors in design of marine structures: approaches & applications, OMAE volume II, Copenhagen, 1995b.
Daniels Gerald R: Hurricane Andrew’s impact on natural gas and oil facilities on the outer continental shelf, interim report as of November 1993, MMI, Herdon, USA, 1994.
DNV Technica: World offshore accidental database, release 4.11, Høvik, 1995
DNV Technica: An overview of risk levels in the offshore industry on the UK Continental shelf (1994), HSE Offshore Technology reports OTH 94 458, HMSO, London, 1995
Fjell Svein: Reliability of offshore structures, OTC 3027, Houston, 1977
Funnemark Espen: Review of 20 years of worldwide offshore accidents, WOAD technical report no 2, DNV, Høvik, 1997.
Hamre Reidar, Arne Kvitrud and Kåre Tesdal: In service experience of fixed offshore structures in Norway, OMAE, Stavanger, 1991.
Kareem Ahsan, Tracy Kijewski og Charles E Smith: Analyses and performance of offshore platforms in hurricanes, Wind and structures, volum 2, no 1, 1999.
Leonhardsen Roger L, Gerhard Ersdal and Arne Kvitrud: Experience and Risk assessment of FPSOs used on the Norwegian Continental Shelf, ISOPE, Stavanger, 2001.
Matousek Miroslav and Jørg Schneider: Untersuchungen zur Struktur des Sicherheitsproblems bei Bauwerken, Institut für Baustatik und Konstruktion, ETH Zürich, Bericht nr. 59, 1976.
Moan Torgeir: Target safety level for reassessment of North Sea offshore platforms, Sintef report STF70 F95201, Trondheim, 12.01.1995.
Paté-Cornell M Elisabeth: Organizational aspects of engineering system safety: The case of offshore platforms, Science, volume 250, pp. 1210-1217, 30th November 1990.
Schneider Jørg: Introduction to safety and reliability analyses, IABSE, Zurich, 1997.
Sharples B P M, W T Bennett Jr and J C Trickey: Risk analyses of jackup rigs, International conference on the jack-up drilling platform, Singapore, 1989.
Snell R O: Safety levels across different structural forms and materials, BP, London, 1996.
Sprouge John: A guide to quantitative risk assessment for offshore installations, The centre of marine and petroleum technology, Aberdeen, 1999.
Tveit Odd J: Risk management approach to FPSOs in Statoil, FPSO Symposium, Bechtel Tower, Houston, March 9-10, 1998
Vinnem Jan Erik, Odd Tveit, Dag Sande, Einar Ravnås, Øyvind Lauritsen and Arne Kvitrud: , NPD, April 2001
Wisch Dave: Hurricane Andrew structural performance information exchange, API meeting transcript, October 29, 1992, API offshore standardization committee fixed systems sub-committee, Houston, 1992.